Apparatus for Detecting In-Vehicle External Data Intrusion by Comparing Multiple Information Entropy and Operating Method Thereof

1. An apparatus for detecting in-vehicle external data intrusion by comparing multiple information entropy, the apparatus comprising a processor configured to: store, for each of a plurality of travelling environment conditions, an upper limit value and a lower limit value of predetermined first reference information entropy, an upper limit value and a lower limit value of predetermined second reference information entropy, and an upper limit value and a lower limit value of predetermined third reference information entropy for detecting external data intrusion on a vehicle, in the apparatus; check a control signal associated with travelling of the vehicle by accessing an Electronic Control Unit (ECU) of the vehicle and check a current travelling environment condition of the vehicle; collect N packets (N is a natural number equal to or larger than 2) sequentially generated through an in-vehicle Controller Area Network (CAN) communication network and generate a packet group formed of the N packets, and count each of the number of times of occurrence of a first overlapping event, a second overlapping event, and a third overlapping event by checking packet identifiers (IDs) allocated to the N packets forming the packet group, wherein the first overlapping event is generated when two packets having a same packet ID are continuously generated through the CAN communication network, the second overlapping event is generated when three packets having a same packet ID are continuously generated through the CAN communication network, and the third overlapping event is generated when four packets having a same packet ID are continuously generated through the CAN communication network; estimate first criteria information entropy representing a quantity of information for first packet IDs generable through the CAN communication network under the current travelling environment condition of the vehicle based on the number of times of the occurrence of the first overlapping event and the number of N packets forming the packet group, estimate second criteria information entropy representing a quantity of information for second packet IDs generable through the CAN communication network under the current travelling environment condition of the vehicle based on the number of times of the occurrence of the second overlapping event and the number of N packets forming the packet group, and estimate third criteria information entropy representing a quantity of information for third packet IDs generable through the CAN communication network under the current travelling environment condition of the vehicle based on the number of times of the occurrence of the third overlapping event and the number of N packets forming the packet group; when the first criteria information entropy, the second criteria information entropy, and the third criteria information entropy are estimated, check whether the first criteria information entropy belongs to values between the upper limit value and the lower limit value of the first reference information entropy stored in the apparatus while corresponding to a travelling environment condition corresponding to the current travelling environment condition of the vehicle, check whether the second criteria information entropy belongs to values between the upper limit value and the lower limit value of the second reference information entropy stored in the apparatus while corresponding to the travelling environment condition corresponding to the current travelling environment condition of the vehicle, and check whether the third criteria information entropy belongs to values between the upper limit value and the lower limit value of the third reference information entropy stored in the apparatus while corresponding to the travelling environment condition corresponding to the current travelling environment condition of the vehicle; and when it is checked that any one of the first criteria information entropy, the second criteria information entropy, and the third criteria information entropy does not belong to the values between the upper limit value and the lower limit values of the first reference information entropy, the second reference information entropy, and the third reference information entropy stored while corresponding to the travelling environment condition corresponding to the current travelling environment condition of the vehicle, determine that the external data intrusion occurs on the vehicle.

2. The apparatus of claim 1 , wherein the processor estimates the first criteria information entropy based on a calculation according to Equation 1 below, estimates the second criteria information entropy based on a calculation according to Equation 2 below, and estimates the third criteria information entropy based on a calculation according to Equation 3 below, R 1 = - log 2 ⁢ S 1 n 1 [ Equation ⁢ ⁢ 1 ] R 2 = - log 2 ⁢ S 2 n 1 [ Equation ⁢ ⁢ 2 ] R 3 = - log 2 ⁢ S 3 n 1 [ Equation ⁢ ⁢ 3 ] herein, R 1 refers to the first criteria information entropy, S 1 refers to the number of times of the occurrence of the first overlapping event, n 1 refers to the number of N packets forming the packet group, R 2 refers to the second criteria information entropy, S 2 refers to the number of times of the occurrence of the second overlapping event, R 3 refers to the third criteria information entropy, and S 3 refers to the number of times of the occurrence of the third overlapping event.

3. The apparatus of claim 1 , wherein the processor is further configured to: when it is checked that any one of the first criteria information entropy, the second criteria information entropy, and the third criteria information entropy belongs to the values between the upper limit value and the lower limit values of the first reference information entropy, the second reference information entropy, and the third reference information entropy stored while corresponding to the travelling environment condition corresponding to the current travelling environment condition of the vehicle, generate a continuous monitoring event, wherein when the continuous monitoring event is generated, the processor checks the control signal associated with the travelling of the vehicle by accessing the ECU of the vehicle again to re-check the current travelling environment condition of the vehicle, the processor re-collects N packets additionally generated through the CAN communication network and regenerates a packet group formed of the re-collected N packets, and checks IDs allocated to the N packets forming the regenerated packet group and counts the number of times of the occurrence of each of the first overlapping event, the second overlapping event, and the third overlapping event again, the processor re-estimates the first criteria information entropy representing a quantity of information for fourth packet IDs generable through the CAN communication network under the re-checked current travelling environment condition of the vehicle based on the re-counted number of times of the occurrence of the first overlapping event and the number of N packets forming the re-generated packet group, re-estimates the second criteria information entropy representing a quantity of information for fifth packet IDs generable through the CAN communication network under the re-checked current travelling environment condition of the vehicle based on the re-counted number of times of the occurrence of the second overlapping event and the number of N packets forming the re-generated packet group, and re-estimates the third criteria information entropy representing a quantity of information for sixth packet IDs generable through the CAN communication network under the re-checked current travelling environment condition of the vehicle based on the re-counted number of times of the occurrence of the third overlapping event and the number of N packets forming the re-generated packet group, when the first criteria information entropy, the second criteria information entropy, and the third criteria information entropy are re-estimated, the processor checks whether the re-estimated first criteria information entropy belongs to the values between the upper limit value and the lower limit value of the first reference information entropy stored in the apparatus while corresponding to the travelling environment condition corresponding to the re-checked current travelling environment condition of the vehicle, checks whether the re-estimated second criteria information entropy belongs to the values between the upper limit value and the lower limit value of the second reference information entropy stored in the apparatus while corresponding to the travelling environment condition corresponding to the re-checked current travelling environment condition of the vehicle, and checks whether the re-estimated third criteria information entropy belongs to the values between the upper limit value and the lower limit value of the third reference information entropy stored in the apparatus while corresponding to the travelling environment condition corresponding to the re-checked current travelling environment condition of the vehicle, and when it is checked that any one of the re-estimated first criteria information entropy, the re-estimated second criteria information entropy, and the re-estimated third criteria information entropy does not belong to the values between the upper limit values and the lower limit values of the first reference information entropy, the second reference information entropy, and the third reference information entropy stored while corresponding to the travelling environment condition corresponding to the re-checked current travelling environment condition of the vehicle, the processor determines that the external data intrusion occurs on the vehicle.

4. The apparatus claim 3 , wherein the processor re-estimates the first criteria information entropy based on a calculation according to Equation 4 below, re-estimates the second criteria information entropy based on a calculation according to Equation 5 below, and re-estimates the third criteria information entropy based on a calculation according to Equation 6 below, R 1 ⁢ r = - log 2 ⁢ w ⁢ S 1 + S 1 ⁢ r ( n 2 × 1 1 - w ) [ Equation ⁢ ⁢ 4 ] R 2 ⁢ r = - ⁢ log 2 ⁢ w ⁢ S 2 + S 2 ⁢ r ( n 2 × 1 1 - w ) [ Equation ⁢ ⁢ 5 ] R 3 ⁢ r = - ⁢ log 2 ⁢ w ⁢ S 3 + S 3 ⁢ r ( n 2 × 1 1 - w ) [ Equation ⁢ ⁢ 6 ] herein, R 1r refers to the re-estimated first criteria information entropy, S 1 refers to the number of times of the occurrence of the first overlapping event, S 1r refers to the re-counted number of times of the occurrence of the first overlapping event, n 2 refers to the number of N packets forming the re-generated packet group, R 2r refers to the re-estimated second criteria information entropy, S 2 refers to the number of times of the occurrence of the second overlapping event, S 2r refers to the re-counted number of times of the occurrence of the second overlapping event, R 3r refers to the re-estimated third criteria information entropy, S 3 refers to the number of times of the occurrence of the third overlapping event, S 3r refers to the re-counted number of times of the occurrence of the third overlapping event, and w refers to a predetermined weight having a size between 0 to 1.

5. The apparatus of claim 1 , the processor is further configured to: repeatedly perform simulation travelling according to each of the plurality of travelling environment conditions on the vehicle as many as the predetermined number of times of a training by applying a control signal to the ECU of the vehicle so as to have a travelling environment according to each of the plurality of travelling environment conditions; count the total number of plurality of packets sequentially generated through the CAN communication network inside the vehicle and the number of times of occurrence of a fourth overlapping event, a fifth overlapping event, and a sixth overlapping event generated for the plurality of packets whenever the simulation travelling is repeatedly performed the predetermined number of times of the training for each of the plurality of travelling environment conditions, and estimate first for-test information entropy representing a quantity of information for fourth packet IDs generable through the CAN communication network according to each of the plurality of travelling environment conditions based on the number of times of the occurrence of the fourth overlapping event, estimate second for-test information entropy representing a quantity of information for fifth packet IDs generable through the CAN communication network according to each of the plurality of travelling environment conditions based on the number of times of the occurrence of the fifth overlapping event, and estimate third for-test information entropy representing a quantity of information for sixth packet IDs generable through the CAN communication network according to each of the plurality of travelling environment conditions based on the number of times of the occurrence of the sixth overlapping event; and check maximum values and minimum values of the first for-test information entropy, the second for-test information entropy, and the third for-test information entropy repeatedly estimated by the predetermined number of times of the training for each of the plurality of travelling environment conditions, and correspond the maximum value and the minimum value of the first for-test information entropy checked for each of the plurality of travelling environment conditions to the upper limit value and the lower limit value of the first reference information entropy for each of the plurality of travelling environment conditions and store the maximum value and the minimum value of the first for-Lest information entropy in the apparatus, correspond the maximum value and the minimum value of the second for-test information entropy checked for each of the plurality of travelling environment conditions to the upper limit value and the lower limit value of the second reference information entropy checked for each of the plurality of travelling environment conditions and store the maximum value and the minimum value of the second for-test information entropy in the apparatus, and correspond the maximum value and the minimum value of the third for-test information entropy checked for each of the plurality of travelling environment conditions to the upper limit value and the lower limit value of the third reference information entropy for each of the plurality of travelling environment conditions and store the maximum value and the minimum value of the third for-test information entropy in the apparatus, wherein the fourth overlapping event is generated when two packets having a same packet ID are continuously generated through the CAN communication network, the fifth overlapping event is generated when three packets having a same packet ID are continuously generated through the CAN communication network, and the sixth overlapping event is generated when four packets having a same packet ID are continuously generated through the CAN communication network.

6. The apparatus of claim 1 , wherein the processor is further configured to: store and maintain a danger level table in which, for each of a plurality of predetermined different danger levels, a different intrusion determination ratio value range corresponding to each danger level is recorded; when it is determined that the external data intrusion occurs on the vehicle through the processor, control the repeated performance of the determination whether the external data intrusion occurs on the vehicle the predetermined number of times of the performance of a first re-determination; when the determination whether the external data intrusion occurs on the vehicle is repeatedly performed the number of times of the performance of the first re-determination, count the number of times that it is determined that the external data intrusion occurs on the vehicle from the result of the repeated performance of the determination whether the external data intrusion occurs on the vehicle and calculate a ratio of the number of times that it is determined that the external data intrusion occurs on the vehicle to the number of times of the performance of the first re-determination; and extract a first danger level corresponding to a first intrusion determination ratio value range to which the calculated ratio belongs from the danger level table and output an alarm message notifying that the state of the vehicle is a danger situation according to the first danger level through a display.

7. A method of operating an apparatus for detecting in-vehicle external data intrusion by comparing multiple information entropy, the method comprising: maintaining the apparatus in which for each of a plurality of travelling environment conditions, an upper limit value and a lower limit value of predetermined first reference information entropy, an upper limit value and a lower limit value of predetermined second reference information entropy, and an upper limit value and a lower limit value of predetermined third reference information entropy for detecting external data intrusion on a vehicle are stored; checking a control signal associated with travelling of the vehicle by accessing an Electronic Control Unit (ECU) of the vehicle and checking a current travelling environment condition of the vehicle; collecting N packets (N is a natural number equal to or larger than 2) sequentially generated through an in-vehicle Controller Area Network (CAN) communication network and generating a packet group formed of the N packets, and counting each of the number of times of occurrence of a first overlapping event, a second overlapping event, and a third overlapping event by checking packet identifiers (IDs) allocated to the N packets forming the packet group, wherein the first overlapping event is generated when two packets having a same packet ID are continuously generated through the CAN communication network, the second overlapping event is generated when three packets having a same packet ID are continuously generated through the CAN communication network, and the third overlapping event is generated when four packets having a same packet ID are continuously generated through the CAN communication network; estimating first criteria information entropy representing a quantity of information for first packet IDs generable through the CAN communication network under the current travelling environment condition of the vehicle based on the number of times of the occurrence of the first overlapping event and the number of N packets forming the packet group, estimating second criteria information entropy representing a quantity of information for second packet IDs generable through the CAN communication network under the current travelling environment condition of the vehicle based on the number of times of the occurrence of the second overlapping event and the number of N packets forming the packet group, and estimating third criteria information entropy representing a quantity of information for third packet IDs ID generable through the CAN communication network under the current travelling environment condition of the vehicle based on the number of times of the occurrence of the third overlapping event and the number of N packets forming the packet group; when the first criteria information entropy, the second criteria information entropy, and the third criteria information entropy are estimated, checking whether the first criteria information entropy belongs to values between the upper limit value and the lower limit value of the first reference information entropy stored in the apparatus while corresponding to a travelling environment condition corresponding to the current travelling environment condition of the vehicle, checking whether the second criteria information entropy belongs to values between the upper limit value and the lower limit value of the second reference information entropy stored in the apparatus while corresponding to the travelling environment condition corresponding to the current travelling environment condition of the vehicle, and checking whether the third criteria information entropy belongs to values between the upper limit value and the lower limit value of the third reference information entropy stored in the apparatus while corresponding to the travelling environment condition corresponding to the current travelling environment condition of the vehicle; and when it is checked that any one of the first criteria information entropy, the second criteria information entropy, and the third criteria information entropy does not belong to the values between the upper limit value and the lower limit values of the first reference information entropy, the second reference information entropy, and the third reference information entropy stored while corresponding to the travelling environment condition corresponding to the current travelling environment condition of the vehicle, determining that the external data intrusion occurs on the vehicle.

8. The method of claim 7 , wherein the estimating of the third criteria information entropy includes estimating the first criteria information entropy based on a calculation according to Equation 1 below, estimating the second criteria information entropy based on a calculation according to Equation 2 below, and estimating the third criteria information entropy based on a calculation according to Equation 3 below, R 1 = - log 2 ⁢ S 1 n 1 [ Equation ⁢ ⁢ 1 ] R 2 = - log 2 ⁢ S 2 n 1 [ Equation ⁢ ⁢ 2 ] R 3 = - log 2 ⁢ S 3 n 1 [ Equation ⁢ ⁢ 3 ] herein, R 1 refers to the first criteria information entropy, S 1 refers to the number of times of the occurrence of the first overlapping event, n 1 refers to the number of N packets forming the packet group, R 2 refers to the second criteria information entropy, S 2 refers to the number of times of the occurrence of the second overlapping event, R 3 refers to the third criteria information entropy, and S 3 refers to the number of times of the occurrence of the third overlapping event.

9. The method of claim 7 , further comprising: when it is checked that any one of the first criteria information entropy, the second criteria information entropy, and the third criteria information entropy belongs to the values between the upper limit value and the lower limit values of the first reference information entropy, the second reference information entropy, and the third reference information entropy stored while corresponding to the travelling environment condition corresponding to the current travelling environment condition of the vehicle, generating a continuous monitoring event; wherein when the continuous monitoring event is generated, checking the control signal associated with the travelling of the vehicle by accessing the ECU of the vehicle again to re-check the current travelling environment condition of the vehicle; re-collecting N packets additionally generated through the CAN communication network and regenerating a packet group formed of the re-collected N packets, and checking IDs allocated to the N packets forming the regenerated packet group and counting the number of times of the occurrence of each of the first overlapping event, the second overlapping event, and the third overlapping event again; re-estimating the first criteria information entropy representing a quantity of information for fourth packet IDs generable through the CAN communication network under the re-checked current travelling environment condition of the vehicle based on the re-counted number of times of the occurrence of the first overlapping event and the number of N packets forming the re-generated packet group, re-estimating the second criteria information entropy representing a quantity of information for fifth packet IDs generable through the CAN communication network under the re-checked current travelling environment condition of the vehicle based on the re-counted number of times of the occurrence of the second overlapping event and the number of N packets forming the re-generated packet group, and re-estimating the third criteria information entropy representing a quantity of information for sixth packet IDs generable through the CAN communication network under the re-checked current travelling environment condition of the vehicle based on the re-counted number of times of the occurrence of the third overlapping event and the number of N packets forming the re-generated packet group; when the first criteria information entropy, the second criteria information entropy, and the third criteria information entropy are re-estimated, checking whether the re-estimated first criteria information entropy belongs to the values between the upper limit value and the lower limit value of the first reference information entropy stored in the apparatus while corresponding to the travelling environment condition corresponding to the re-checked current travelling environment condition of the vehicle, checking whether the re-estimated second criteria information entropy belongs to the values between the upper limit value and the lower limit value of the second reference information entropy stored in the apparatus while corresponding to the travelling environment condition corresponding to the re-checked current travelling environment condition of the vehicle, and checking whether the re-estimated third criteria information entropy belongs to the values between the upper limit value and the lower limit value of the third reference information entropy stored in the apparatus while corresponding to the travelling environment condition corresponding to the re-checked current travelling environment condition of the vehicle, and when it is checked that any one of the re-estimated first criteria information entropy, the re-estimated second criteria information entropy, and the re-estimated third criteria information entropy does not belong to the values between the upper limit values and the lower limit values of the first reference information entropy, the second reference information entropy, and the third reference information entropy stored while corresponding to the travelling environment condition corresponding to the re-checked current travelling environment condition of the vehicle, determining that the external data intrusion occurs on the vehicle.

10. The method of claim 9 , wherein the re-estimating of the third criteria information entropy includes re-estimating the first criteria information entropy based on a calculation according to Equation 4 below, re-estimating the second criteria information entropy based on a calculation according to Equation 5 below, and re-estimating the third criteria information entropy based on a calculation according to Equation 6 below, R 1 ⁢ r = - log 2 ⁢ w ⁢ S 1 + S 1 ⁢ r ( n 2 × 1 1 - w ) [ Equation ⁢ ⁢ 4 ] R 2 ⁢ r = - ⁢ log 2 ⁢ w ⁢ S 2 + S 2 ⁢ r ( n 2 × 1 1 - w ) [ Equation ⁢ ⁢ 5 ] R 3 ⁢ r = - ⁢ log 2 ⁢ w ⁢ S 3 + S 3 ⁢ r ( n 2 × 1 1 - w ) [ Equation ⁢ ⁢ 6 ] herein, R 1r refers to the re-estimated first criteria information entropy, S 1 refers to the number of times of the occurrence of the first overlapping event, S 1r refers to the re-counted number of times of the occurrence of the first overlapping event, n 2 refers to the number of N packets forming the re-generated packet group, R 2r refers to the re-estimated second criteria information entropy, S 2 refers to the number of times of the occurrence of the second overlapping event, S 2r refers to the re-counted number of times of the occurrence of the second overlapping event, R 3r refers to the re-estimated third criteria information entropy, S 3 refers to the number of times of the occurrence of the third overlapping event, S 3r refers to the re-counted number of times of the occurrence of the third overlapping event, and w refers to a predetermined weight having a size between 0 to 1.

11. The method of claim 7 , further comprising: repeatedly performing simulation travelling according to each of the plurality of travelling environment conditions on the vehicle as many as the predetermined number of times of a training by applying a control signal to the ECU of the vehicle so as to have a travelling environment according to each of the plurality of travelling environment conditions; counting the total number of plurality of packets sequentially generated through the CAN communication network and the number of times of occurrence of a fourth overlapping event, a fifth overlapping event, and a sixth overlapping event generated for the plurality of packets whenever the simulation travelling is repeatedly performed the predetermined number of times of the training for each of the plurality of travelling environment conditions, and estimating first for-test information entropy representing a quantity of information for fourth packet IDs generable through the CAN communication network according to each of the plurality of travelling environment conditions based on the number of times of the occurrence of the fourth overlapping event, estimating second for-test information entropy representing a quantity of information for fifth packet IDs generable through the CAN communication network according to each of the plurality of travelling environment conditions based on the number of times of the occurrence of the fifth overlapping event, and estimating third for-test information entropy representing a quantity of information for sixth packet IDs generable through the CAN communication network according to each of the plurality of travelling environment conditions based on the number of times of the occurrence of the sixth overlapping event; and checking maximum values and minimum values of the first for-Lest information entropy, the second for-test information entropy, and the third for-test information entropy repeatedly estimated by the predetermined number of times of the training for each of the plurality of travelling environment conditions, and corresponding the maximum value and the minimum value of the first for-test information entropy checked for each of the plurality of travelling environment conditions to the upper limit value and the lower limit value of the first reference information entropy for each of the plurality of travelling environment conditions and storing the maximum value and the minimum value of the first for-test information entropy in the apparatus, corresponding the maximum value and the minimum value of the second for-test information entropy checked for each of the plurality of travelling environment conditions to the upper limit value and the lower limit value of the second reference information entropy checked for each of the plurality of travelling environment conditions and storing the maximum value and the minimum value of the second for-test information entropy in the apparatus, and corresponding the maximum value and the minimum value of the third for-test information entropy checked for each of the plurality of travelling environment conditions to the upper limit value and the lower limit value of the third reference information entropy checked for each of the plurality of travelling environment conditions and storing the maximum value and the minimum value of the third for-test information entropy in the apparatus, wherein the fourth overlapping event is generated when two packets having a same packet ID are continuously generated through the CAN communication network, the fifth overlapping event is generated when three packets having a same packet ID are continuously generated through the CAN communication network, and the sixth overlapping event is generated when four packets having a same packet ID are continuously generated through the CAN communication network.

12. The method of claim 7 , further comprising: storing and maintaining a danger level table in which, for each of a plurality of predetermined different danger levels, a different intrusion determination ratio value range corresponding to each danger level is recorded; when it is determined that the external data intrusion occurs on the vehicle, controlling the repeated performance of the determination whether the external data intrusion occurs on the vehicle the predetermined number of times of the performance of a first re-determination; when the determination whether the external data intrusion occurs on the vehicle is repeatedly performed the number of times of the performance of the first re-determination, counting the number of times that it is determined that the external data intrusion occurs on the vehicle from the result of the repeated performance of the determination whether the external data intrusion occurs on the vehicle and calculating a ratio of the number of times that it is determined that the external data intrusion occurs on the vehicle to the number of times of the performance of the first re-determination; and extracting a first danger level corresponding to a first intrusion determination ratio value range to which the calculated ratio belongs from the danger level table and outputting an alarm message notifying that the state of the vehicle is a danger situation according to the first danger level through a display.

13. A non-transitory computer readable recording medium having a program recorded therein for allowing a computer to execute a method of operating an apparatus for detecting in-vehicle external data intrusion by comparing multiple information entropy, the method comprising: maintaining the apparatus in which for each of a plurality of travelling environment conditions, an upper limit value and a lower limit value of predetermined first reference information entropy, an upper limit value and a lower limit value of predetermined second reference information entropy, and an upper limit value and a lower limit value of predetermined third reference information entropy for detecting external data intrusion on a vehicle are stored; checking a control signal associated with travelling of the vehicle by accessing an Electronic Control Unit (ECU) of the vehicle and checking a current travelling environment condition of the vehicle; collecting N packets (N is a natural number equal to or larger than 2) sequentially generated through an in-vehicle Controller Area Network (CAN) communication network and generating a packet group formed of the N packets, and counting each of the number of times of occurrence of a first overlapping event, a second overlapping event, and a third overlapping event by checking packet identifiers (IDs) allocated to the N packets forming the packet group, wherein the first overlapping event is generated when two packets having a same packet ID are continuously generated through the CAN communication network, the second overlapping event is generated when three packets having a same packet ID are continuously generated through the CAN communication network, and the third overlapping event is generated when four packets having a same packet ID are continuously generated through the CAN communication network; estimating first criteria information entropy representing a quantity of information for first packet IDs generable through the CAN communication network under the current travelling environment condition of the vehicle based on the number of times of the occurrence of the first overlapping event and the number of N packets forming the packet group, estimating second criteria information entropy representing a quantity of information for second packet IDs generable through the CAN communication network under the current travelling environment condition of the vehicle based on the number of times of the occurrence of the second overlapping event and the number of N packets forming the packet group, and estimating third criteria information entropy representing a quantity of information for third packet IDs generable through the CAN communication network under the current travelling environment condition of the vehicle based on the number of times of the occurrence of the third overlapping event and the number of N packets forming the packet group; when the first criteria information entropy, the second criteria information entropy, and the third criteria information entropy are estimated, checking whether the first criteria information entropy belongs to values between the upper limit value and the lower limit value of the first reference information entropy stored in the apparatus while corresponding to a travelling environment condition corresponding to the current travelling environment condition of the vehicle, checking whether the second criteria information entropy belongs to values between the upper limit value and the lower limit value of the second reference information entropy stored in the apparatus while corresponding to the travelling environment condition corresponding to the current travelling environment condition of the vehicle, and checking whether the third criteria information entropy belongs to values between the upper limit value and the lower limit value of the third reference information entropy stored in the apparatus while corresponding to the travelling environment condition corresponding to the current travelling environment condition of the vehicle; and when it is checked that any one of the first criteria information entropy, the second criteria information entropy, and the third criteria information entropy does not belong to the values between the upper limit value and the lower limit values of the first reference information entropy, the second reference information entropy, and the third reference information entropy stored while corresponding to the travelling environment condition corresponding to the current travelling environment condition of the vehicle, determining that the external data intrusion occurs on the vehicle.